1 1 00:00:00,240 --> 00:00:01,920 Communication plan. 2 2 00:00:01,920 --> 00:00:03,690 Another thing we need to consider 3 3 00:00:03,690 --> 00:00:07,290 during our preparation phase is our communication plan. 4 4 00:00:07,290 --> 00:00:09,150 How are we going to make our communications 5 5 00:00:09,150 --> 00:00:11,430 back to home station or up to leadership 6 6 00:00:11,430 --> 00:00:13,740 in the event of an incident response? 7 7 00:00:13,740 --> 00:00:14,940 This is extremely important, 8 8 00:00:14,940 --> 00:00:16,650 especially in large organizations 9 9 00:00:16,650 --> 00:00:17,940 where you have a distributed workforce 10 10 00:00:17,940 --> 00:00:20,580 around the country or around the world. 11 11 00:00:20,580 --> 00:00:23,280 Your teams have to have a secure method of communication 12 12 00:00:23,280 --> 00:00:24,940 for managing your incidents. 13 13 00:00:24,940 --> 00:00:26,430 Now, this is really important 14 14 00:00:26,430 --> 00:00:28,770 because if you have a VoIP system, for instance, 15 15 00:00:28,770 --> 00:00:30,720 and that's what you're going to use to communicate, 16 16 00:00:30,720 --> 00:00:32,730 well, if an attacker is in that VoIP system, 17 17 00:00:32,730 --> 00:00:34,140 they can hear everything you're saying 18 18 00:00:34,140 --> 00:00:36,540 and they will be tipped off as to all the things 19 19 00:00:36,540 --> 00:00:38,550 you're doing and they can pivot away from you 20 20 00:00:38,550 --> 00:00:40,440 and gain access further into your systems 21 21 00:00:40,440 --> 00:00:42,150 before you can get them out. 22 22 00:00:42,150 --> 00:00:43,680 And so often what we want to do 23 23 00:00:43,680 --> 00:00:46,440 is use an out-of-band communication system. 24 24 00:00:46,440 --> 00:00:48,450 Now, an out-of-band communication system 25 25 00:00:48,450 --> 00:00:50,190 is one where your signals are being sent 26 26 00:00:50,190 --> 00:00:52,000 between two parties or two devices 27 27 00:00:52,000 --> 00:00:54,060 that are sent via a path or method 28 28 00:00:54,060 --> 00:00:55,800 that's different from the primary communication 29 29 00:00:55,800 --> 00:00:57,960 between those two parties or devices. 30 30 00:00:57,960 --> 00:01:00,540 Now, that's a really complicated way of saying things, 31 31 00:01:00,540 --> 00:01:03,030 but let's say normally you would go ahead 32 32 00:01:03,030 --> 00:01:04,140 and report to your manager 33 33 00:01:04,140 --> 00:01:05,670 using your corporate email account. 34 34 00:01:05,670 --> 00:01:08,400 Well, if you think that corporate email has been compromised 35 35 00:01:08,400 --> 00:01:10,920 you don't want to use that as your communication method. 36 36 00:01:10,920 --> 00:01:13,830 Instead, you want to use an out-of-band communication. 37 37 00:01:13,830 --> 00:01:15,450 That might mean you're going to make a call 38 38 00:01:15,450 --> 00:01:17,250 from your cell phone to their cell phone, 39 39 00:01:17,250 --> 00:01:19,770 or you might use an encrypted path. 40 40 00:01:19,770 --> 00:01:21,810 For example, one of the most commonly used ones 41 41 00:01:21,810 --> 00:01:25,530 is something like WhatsApp or Signal or Off the Record. 42 42 00:01:25,530 --> 00:01:27,690 All of these apps have messaging systems 43 43 00:01:27,690 --> 00:01:29,190 with end-to-end encryption, 44 44 00:01:29,190 --> 00:01:31,170 so no attacker can see the information 45 45 00:01:31,170 --> 00:01:32,970 in between that's being sent. 46 46 00:01:32,970 --> 00:01:35,940 And so oftentimes, we'll have a channel set up on WhatsApp 47 47 00:01:35,940 --> 00:01:39,540 as a way for us to use as a communication mechanism. 48 48 00:01:39,540 --> 00:01:40,800 Now, one of the problems with this 49 49 00:01:40,800 --> 00:01:43,290 is using WhatsApp requires you to have a cell phone. 50 50 00:01:43,290 --> 00:01:44,820 And so oftentimes, you have to think about 51 51 00:01:44,820 --> 00:01:47,790 what is my primary path and what's going to be my backup? 52 52 00:01:47,790 --> 00:01:50,880 So what is your backup communication plan going to be? 53 53 00:01:50,880 --> 00:01:53,280 Well, you have to consider how you're going to communicate 54 54 00:01:53,280 --> 00:01:55,020 with the people who are on call, 55 55 00:01:55,020 --> 00:01:57,540 especially when you have a distributed workforce. 56 56 00:01:57,540 --> 00:01:59,940 For example, one organization I worked at, 57 57 00:01:59,940 --> 00:02:01,920 we had a team that was actually flown out 58 58 00:02:01,920 --> 00:02:04,350 to a center that was dealing with an incident. 59 59 00:02:04,350 --> 00:02:06,240 Now, that center, they weren't allowed 60 60 00:02:06,240 --> 00:02:09,030 to have smartphones inside that organization. 61 61 00:02:09,030 --> 00:02:10,770 And so when they went into the building, 62 62 00:02:10,770 --> 00:02:12,210 we couldn't communicate with them. 63 63 00:02:12,210 --> 00:02:14,730 So we had to have a way for that team to respond to us 64 64 00:02:14,730 --> 00:02:17,010 even though they couldn't have smartphones in the building. 65 65 00:02:17,010 --> 00:02:18,480 And what we ended up coming up with 66 66 00:02:18,480 --> 00:02:20,760 was that every hour, somebody would leave the building, 67 67 00:02:20,760 --> 00:02:22,620 go to their car, get their smartphone, 68 68 00:02:22,620 --> 00:02:24,660 and then call in to check with us. 69 69 00:02:24,660 --> 00:02:25,860 This is a way of doing things, 70 70 00:02:25,860 --> 00:02:27,210 but again, it was our backup plan 71 71 00:02:27,210 --> 00:02:30,060 that if you can't do this, then you should do this. 72 72 00:02:30,060 --> 00:02:32,070 And every hour, send us a message. 73 73 00:02:32,070 --> 00:02:32,903 That was one of the ways 74 74 00:02:32,903 --> 00:02:34,680 we were able to work our way through this. 75 75 00:02:34,680 --> 00:02:35,880 Maybe you're going to send them to an area 76 76 00:02:35,880 --> 00:02:37,530 that doesn't have good cellular coverage. 77 77 00:02:37,530 --> 00:02:39,520 So instead, they're going to have to use a satellite phone 78 78 00:02:39,520 --> 00:02:41,670 or some other method like that. 79 79 00:02:41,670 --> 00:02:43,350 You're going to have to think these things through 80 80 00:02:43,350 --> 00:02:45,810 for your organization based on your own incidents 81 81 00:02:45,810 --> 00:02:47,490 and your own response plans. 82 82 00:02:47,490 --> 00:02:48,960 Another thing you want to make sure you're doing 83 83 00:02:48,960 --> 00:02:52,410 is always make sure you maintain an up-to-date contact list. 84 84 00:02:52,410 --> 00:02:54,540 The best way to prepare for your team's activation 85 85 00:02:54,540 --> 00:02:56,460 for a future response is to ensure 86 86 00:02:56,460 --> 00:02:58,110 you have an accurate contact list 87 87 00:02:58,110 --> 00:03:00,030 that is prepared ahead of time. 88 88 00:03:00,030 --> 00:03:01,770 This will include things like their phone numbers 89 89 00:03:01,770 --> 00:03:03,540 and email addresses for each member 90 90 00:03:03,540 --> 00:03:04,950 of the incident response team, 91 91 00:03:04,950 --> 00:03:07,080 as well as others within the organization 92 92 00:03:07,080 --> 00:03:09,700 and your third-party partner organizations. 93 93 00:03:09,700 --> 00:03:12,120 By ensuring you have an accurate contact list 94 94 00:03:12,120 --> 00:03:14,580 that is ready to go, you're going to be better prepared 95 95 00:03:14,580 --> 00:03:15,660 when you receive the message 96 96 00:03:15,660 --> 00:03:17,700 that your team needs to be activated, 97 97 00:03:17,700 --> 00:03:19,830 and in the case of people who have to fly away 98 98 00:03:19,830 --> 00:03:21,900 for a remote response, you're ready to go 99 99 00:03:21,900 --> 00:03:24,630 because you have all the information you need. 100 100 00:03:24,630 --> 00:03:26,250 Another part of your communication plan 101 101 00:03:26,250 --> 00:03:28,650 that you have to consider is what is your escalation 102 102 00:03:28,650 --> 00:03:31,200 procedure going to be for your organization? 103 103 00:03:31,200 --> 00:03:33,240 Basically, at what point should you call 104 104 00:03:33,240 --> 00:03:35,130 the on-call person or team? 105 105 00:03:35,130 --> 00:03:37,530 What exactly defines when the event or incident 106 106 00:03:37,530 --> 00:03:39,390 is bad enough that you need to call somebody 107 107 00:03:39,390 --> 00:03:41,010 and wake them up at three in the morning 108 108 00:03:41,010 --> 00:03:42,450 instead of waiting till they show up at work 109 109 00:03:42,450 --> 00:03:43,920 at 8 a.m. the next day? 110 110 00:03:43,920 --> 00:03:45,600 This is especially important 111 111 00:03:45,600 --> 00:03:47,220 if you're going to use contract personnel 112 112 00:03:47,220 --> 00:03:50,240 because when you call in contract personnel after hours, 113 113 00:03:50,240 --> 00:03:52,860 this can actually have huge additional charges 114 114 00:03:52,860 --> 00:03:55,350 per the contract, so you need to make sure it's clearly 115 115 00:03:55,350 --> 00:03:57,440 outlined based on your organizational priorities 116 116 00:03:57,440 --> 00:03:59,520 when you're going to call somebody in. 117 117 00:03:59,520 --> 00:04:01,080 If somebody's email was hacked, 118 118 00:04:01,080 --> 00:04:02,580 you may not call them in for that, 119 119 00:04:02,580 --> 00:04:04,440 but if your credit card system was hacked, 120 120 00:04:04,440 --> 00:04:07,200 you may do that for that because it's protected information. 121 121 00:04:07,200 --> 00:04:08,850 These are the type of things you have to think about 122 122 00:04:08,850 --> 00:04:10,080 and make sure you have the right policies 123 123 00:04:10,080 --> 00:04:11,820 and procedures in place. 124 124 00:04:11,820 --> 00:04:13,830 Now, another thing we have to think about 125 125 00:04:13,830 --> 00:04:15,930 is how are we going to notify people? 126 126 00:04:15,930 --> 00:04:18,060 Based on the prioritization and categorization 127 127 00:04:18,060 --> 00:04:20,130 of an incident, we're going to have different levels 128 128 00:04:20,130 --> 00:04:22,860 of notification from none to an email 129 129 00:04:22,860 --> 00:04:24,400 to a 3 a.m. wake-up call. 130 130 00:04:24,400 --> 00:04:26,910 If it's a minor incident that's well understood 131 131 00:04:26,910 --> 00:04:29,020 and considered to have low or no priority, 132 132 00:04:29,020 --> 00:04:31,890 then our organization may have procedures in place 133 133 00:04:31,890 --> 00:04:33,990 so the incident handlers and security teams 134 134 00:04:33,990 --> 00:04:35,460 will simply take care of the incident 135 135 00:04:35,460 --> 00:04:37,410 without telling anybody about it. 136 136 00:04:37,410 --> 00:04:39,300 If we have a more serious incident, though, 137 137 00:04:39,300 --> 00:04:40,530 we're going to have to follow our procedures 138 138 00:04:40,530 --> 00:04:44,080 to notify the right individuals up our organizational chain. 139 139 00:04:44,080 --> 00:04:46,920 This may include people like the chief information officer 140 140 00:04:46,920 --> 00:04:48,300 or the chief security officer 141 141 00:04:48,300 --> 00:04:50,640 or the chief information security officer, 142 142 00:04:50,640 --> 00:04:52,170 the incident response team members, 143 143 00:04:52,170 --> 00:04:54,510 the system owners, the system administrators, 144 144 00:04:54,510 --> 00:04:56,970 our point of contact within human resources, 145 145 00:04:56,970 --> 00:05:00,030 a legal department representative, or even public affairs. 146 146 00:05:00,030 --> 00:05:02,550 Maybe we even have to call law enforcement. 147 147 00:05:02,550 --> 00:05:04,320 All of this and the exact methods 148 148 00:05:04,320 --> 00:05:06,150 that you're going to use for these notifications 149 149 00:05:06,150 --> 00:05:08,120 will be based on your organization's procedures 150 150 00:05:08,120 --> 00:05:10,950 that are going to be developed during this preparation phase 151 151 00:05:10,950 --> 00:05:13,500 of the incident response lifecycle. 152 152 00:05:13,500 --> 00:05:15,900 Now, in addition to figuring out who you're going to notify, 153 153 00:05:15,900 --> 00:05:18,510 you have to know how you're going to notify them. 154 154 00:05:18,510 --> 00:05:21,780 This can include using email, internal web portals, 155 155 00:05:21,780 --> 00:05:25,380 telephone calls, an in-person update, leaving a voicemail, 156 156 00:05:25,380 --> 00:05:28,200 setting up a formal report or other forms of notification 157 157 00:05:28,200 --> 00:05:31,820 that your company decides is desirable and effective. 158 158 00:05:31,820 --> 00:05:34,680 In most organizations I've worked at in the past, 159 159 00:05:34,680 --> 00:05:37,000 we've used a phone call or an in-person notification 160 160 00:05:37,000 --> 00:05:39,630 for urgent and high-priority incidents, 161 161 00:05:39,630 --> 00:05:42,870 and then we follow it up with an email or a report. 162 162 00:05:42,870 --> 00:05:44,400 For a medium-priority issue, 163 163 00:05:44,400 --> 00:05:47,100 we generally will rely on an email, a voicemail, 164 164 00:05:47,100 --> 00:05:50,310 or possibly even a phone call if it's during working hours. 165 165 00:05:50,310 --> 00:05:51,990 If it's a low-priority incident, 166 166 00:05:51,990 --> 00:05:54,720 then we may handle this through a daily or weekly report 167 167 00:05:54,720 --> 00:05:56,640 or through an intranet portal. 168 168 00:05:56,640 --> 00:05:58,770 This is definitely an area where you want to tailor it 169 169 00:05:58,770 --> 00:06:01,650 to suit the needs and desires of your organization. 170 170 00:06:01,650 --> 00:06:03,330 So you need to make sure you're involving those 171 171 00:06:03,330 --> 00:06:05,160 who are going to be notified and ask them 172 172 00:06:05,160 --> 00:06:06,780 what method works best for them 173 173 00:06:06,780 --> 00:06:09,440 and for which categories they want you to use it. 174 174 00:06:09,440 --> 00:06:11,130 The final thing we need to talk about 175 175 00:06:11,130 --> 00:06:12,780 when we're dealing with communication plans 176 176 00:06:12,780 --> 00:06:16,020 is how far out do you want this information to go? 177 177 00:06:16,020 --> 00:06:17,760 And what I mean by that is we want to make sure 178 178 00:06:17,760 --> 00:06:19,950 we're preventing unauthorized release of information 179 179 00:06:19,950 --> 00:06:22,050 outside of your CSIRT. 180 180 00:06:22,050 --> 00:06:24,120 This is because we don't want this information 181 181 00:06:24,120 --> 00:06:26,850 prematurely hitting the front page news. 182 182 00:06:26,850 --> 00:06:29,340 It is not helpful for an incident to be publicized 183 183 00:06:29,340 --> 00:06:31,060 in the press or through social media 184 184 00:06:31,060 --> 00:06:33,870 outside of your planned communications. 185 185 00:06:33,870 --> 00:06:35,960 Anything that's going to go outside of the team 186 186 00:06:35,960 --> 00:06:38,280 needs to go through the appropriate parties 187 187 00:06:38,280 --> 00:06:40,200 and through public relations. 188 188 00:06:40,200 --> 00:06:42,120 You also need to ensure that parties 189 189 00:06:42,120 --> 00:06:44,640 with privileged information do not release this information 190 190 00:06:44,640 --> 00:06:48,510 to untrusted parties whether intentionally or inadvertently. 191 191 00:06:48,510 --> 00:06:50,960 Remember, if something's going to get out onto Facebook 192 192 00:06:50,960 --> 00:06:55,110 or Twitter or onto Google News or any other news site, 193 193 00:06:55,110 --> 00:06:57,360 you want to make sure it's done appropriately 194 194 00:06:57,360 --> 00:07:00,000 through the organization with your public relations team 195 195 00:07:00,000 --> 00:07:01,980 and making sure that they are in the know 196 196 00:07:01,980 --> 00:07:04,280 and that they are the ones who are doing that.